[chii]

> They would say that they won't consider it as a bug, silently fix it and you are left there doing the work for free.

then as long as you have a trail that proves you discovered and reported it, you can make this a PR nightmare for them with noise about it publicly. The fact that it is fixed means it is considered an issue, and so by declining to acknowledge the issue and refusing to pay, they're essentially deleting the built-up trust of a bug bounty.

It won't pay out even if you did this of course, but if this happens a lot, the aggregate reputational damage leads to "do not report". That's really the only outcome you can engineer, but it is decently damaging that google _should_ see and prevent it.